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Abstract 



We study a (k, m)-threshold controlling scheme for con- 
trolled quantum teleportation. A standard polynomial 
coding over GF(p) with prime p > m— 1 needs to distribute 
a d-dimensional qudit with d > p to each controller for 
this purpose. We propose a scheme using m qubits (two- 
dimensional qudits) for the controllers' portion, following a 
discussion on the benefit of a quantum control in compari- 
son to a classical control of a quantum teleportation. 
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1 Introduction 

Quantum teleportation [1 has been one of the leading dis- 
coveries followed by numerous quantum information pro- 
cessing technologies [H [3]. Controlled quantum teleporta- 
tion [H O [6l [3 [8j is a variant in which a teleportation of 
a quantum state is performed under the supervision of con- 
trollers. Schemes using qubits as keys distributed among 
controllers [H [FJ EE [5] have been extensively studied and 
economization of required resources has been accomplished 
with respect to the number of qubits involved in an entan- 
gled qubit chain used in a scheme. The studies also include 
a security discussion on players' cheating controllers [9]. 

It is expected that a multifunctional quantum network is 
realized for a consumer market in future, presumably based 
on optical fibers. So far, simple quantum cryptosystems 
[101 HU are highly developed [H H3 HI EH US EEZ] to- 
ward the consumer use, which are mainly used to generate 
classical shared cryptographic keys. An advanced quantum 
network should be used not only for generating a classical 
key but for exchanging quantum states. A network with 
Einstein-Podolsky- Rosen (EPR) pairs as links 18J is a plau- 
sible form for this purpose; optical quantum teleportation 
has already become a well-established subject supported by 



many experimental demonstrations reported in, e.g., Refs. 
[19l [20l [2T] . Considering an application for office networks, 
it is demanded that data transfers can be under the control 
of multiple supervisors. Controlled teleportation schemes 
have been developed to enable this feature. As the number 
of usable qubits and the quality of entanglement enhances, 
this function is approaching reality. A function like a vote to 
permit a transfer is also considered to be of public demand. 

Qubit keys are commonly used in controlled quantum tele- 
portation schemes for the basic control such that approvals 
of all the controllers are required to let the players transfer 
a quantum state. In such a control, use of qubit keys is suf- 
ficient and extending each dimension of a quantum system 
for a key causes a redundancy. Qudits (d-dimensional quan- 
tum systems) with d > 2 have been, in contrast, considered 
to be useful as keys when a vote for decision is in order. 

It is easy to notice that such functions are enabled by 
using a threshold scheme [H [23l Hfl [25j [26]: controlling 
a transfer of a quantum state with a certain threshold in 
the number of controllers is implemented by secret sharing 
schemes (see, e.g., a discussion in Ref. [22 )• This catego- 
rizes controlled quantum teleportation as a combination of 
quantum secret sharing and quantum teleportation. A well- 
known polynomial coding 23 , 26j over GF(p) with prime p 
larger than the number m of participants (controllers in our 
context) is a quick solutiorQ. A classical or quantum (k, m)- 
threshold scheme applied to a shared state of players and 
controllers enables a control such that a receiver can recover 
an original state when and only when k or more controllers 
among m provide their keys. There is a variant of quan- 
tum polynomial coding robust against a certain number of 
cheaters among participants [28j . 

A drawback to introduce a polynomial coding scheme in 
controlled quantum teleportation is that computation is con- 
ducted over the field GF(p). Thus each qudit distributed 
among controllers should have the dimension d > p. This 
also complicates a quantum circuit to compute a matrix 
equation for the coding. For a threshold scheme, i.e., a 
secret sharing without imposing access structural, the di- 
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^^Note that p can be equal to m if m is prime in the context of 
controlled quantum teleportation (See Sec. [3). 

2 See, e.g., Ref. I29| and citations therein for secret sharing schemes 
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mension of each key (share) using best known classical pro- 
tocols [30l [31] is 0(2 m ) (namely, 0(m) bits for each key) 
for a long secret. These protocols require the bit length of 
a secret 0(m) and that of a key at least as much as the 
length of a secret. For a short secret, a best known classical 
protocol is Shamir's one [33] in which each key has the di- 
mension > p > m. It is thus not motivating to simply make 
a quantum extension of the classical protocols. 

It was reported that an (m, m)-threshold secret sharing 
of a classical secret is achieved by a sort of key distribu- 
tion without entanglement |32j and an (m, m)-threshold con- 
trolled quantum teleportation is achieved by using classical 
keys [33]. The latter one is easily extended to a (k, m)- 
threshold controlling scheme. Nevertheless, schemes using 
qudits for controllers' portion are more secure than the one 
using only classical keys as we will discuss in Sec. I4.1L There 
is a recently-proposed graph-state formalism [34] to produce 
quantum secret sharing systems using only qubits. This ap- 
proach has achieved the systems for several particular (k, m) 
and not for general (k, m). We will construct a scheme which 
is not a direct extension of these approaches. 

In this paper, we introduce a (k, m)-threshold controlled 
quantum teleportation scheme over GF(p) with prime p > 
to — 1 using to qubits for the controllers' portion in addition 
to classical information distributed to the controllers. This 
is achieved by a hybrid of classical and quantum protocols. 
It enables a reduction in the dimension of each qudit to 
two for general (k, m), which is a significant improvement 
for realizing the scheme. In contrast to classical systems, 
the dimension of a quantum system is limited and usually a 
large-dimensional qudit is implemented by multiple qubits. 
The size of a qudit register is also very limited in the present 
technology. The number of available qubits is, so far, twelve 
or less [35] . 

To begin with, a standard controlled quantum telepor- 
tation scheme is briefly described in Sec. O On the basis 
of the scheme, a (k, 777,)-threshold controlled quantum tele- 
portation using a polynomial coding is briefly explained in 
Sec. [3J A reduction in required resources for the threshold- 
control scheme is accomplished in Sec. [U First, a classical 
control of a quantum teleportation is discussed in Sec. 14.11 
Second, a control of a quantum teleportation using m qubits 
for the controllers' portion is introduced in Sec. 14.21 Third, 
an economization of Bob's operations is accomplished in Sec. 
14.31 An explicit preparation of an initial state for this econ- 
omized scheme is shown in Sec. [5] together with the opera- 
tional complexity of the whole process. We discuss advan- 
tages and disadvantages of the scheme in Sec. [H Section [7] 
summarizes our results. 



2 A Standard Controlled Quantum 
Teleportation 

Consider a controlled quantum teleportation using (77 — 1) 
EPR pairs shared by Alice and Bob, and a single quantum 
system shared by Alice, Bob, and 777 controllers. Alice tries 
to send an 77-qubit state 

1...1 

y ' Pxi...x n \ x l ■ ■ ■ x n)A'i...A' n 
x\ .. .x n — 0. . .0 

of the system A' to Bob. A standard quantum teleporta- 
tion protocol works fine for the (77 — l)-EPR-pair channel 
consisting of {n— 1) pairs A1B1, A n _iB n _i. The remain- 
ing channel, A„B„, is under the control of m controllers 
Ci, C m . The setup of the quantum system is illustrated 
in Fig.[T] Here it should be noted that, although we consider 
the control of a single channel here, it is straightforward to 
attach controllers to each channel. Thus let us limit setups 
to the illustrated one in the following. The initial state of 
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Figure 1 : Illustration of qudit sharing for a controlled quan- 
tum teleportation. 



the illustrated system is given by 
1...1 

|A'ABC) = ( Px 1 ...x n \xx...x n ) A ' 1 ...A'. 




-7= IVl>A>l>B, 
1=1 „ -0 



A„B„Ci...C„ 



with 



I 1 

IOA„B„c 1 ...c m = -j=^2\yy)A n B n \K{ y )) Cl ... Cm (i) 

a shared state involving the controllers' portion |«;(y))ci...C„, 
to be engineered for a tailored controlling scheme. 
Let us recall the well-known relation 



x(Byh 



i=0 



involving access structures. 



where \x,y) is a computational basis vector and |-B,-j) = 
(1/V2) Y. x =o(- l ) X ' l \ x ij® x ) is the (hj) th - Bell basis vector 
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(here, j = x®y, i.e., y = j © x). With this relation, we can 
rewrite the initial state as 



|A'ABC) 

4 E f0EE(-D Xi 



r /n-1 1 1 



xi...x„ M=l ij=0 3j=0 

\ / 1 1 ( 2 ) 
x |Bi,j,)A',A,|j,©a?,>B,J <8> ( E E^ 1 )""' 171 

' N„=0j'„=0 
x I- 6 *™ j„)A'„A„|jn © a;n)B„ |k(j„ © X„)) Cl ...C„ 

As is usual for a standard quantum teleportation, Alice 
makes Bell measurement on each (A'; A;) pair and obtains 
an outcome (i t , j l ). 

Bob receives information {{i t ,j t )} from Alice and applies 
Z H X^' to Bi...B„_i. This changes the state of each 
B; (of each term in the summation) from (— l) x i' l i \j t ©x^b, 
to Ix^b, and hence the teleportation process for the original 
state of A' is completed up to I = n — 1. 

To complete the recovery of the original state of A' at 
Bob's side, he has to apply a certain operation to B„. This 
requires Bob to know the effect of controllers' measurements 
on \n(j n © £n))ci...c,„- Operations Bob has to apply to B ra 
depend on the controlling scheme. 

A popular controlled quantum teleportation scheme 
is the case where \i^{y))c 1 ...C m is set to \y . . . y)c 1 ...C m , 
i.e., |£)A„B„Ci...C m is set to a Greenberger-Horne-Zeilinger 
(GHZ) state, and each controller makes a measurement in 
the X basis. Measuring C s in the X basis results in the 
phase factor (— l)f'(' l s ==-1 ) depending on the outcome h s 
(here, s € {1, ...,m}; the operation "==" returns one if its 
two arguments are equal and zero otherwise j3- In this case, 
Bob first applies Z ln X^ n to B ra . In addition, he applies a 
single Z gate to B„ for recovery if the number of — 's in the 
controllers' outcomes (<E ±) is odd. The final state of Bob 
after these operations becomes ^ x p xi ...x n ®ILi \ x i)bi ■ 
The teleportation is successful in this way. 

In this contribution, we aim to introduce a threshold- 
control scheme in which the shared state |£)A„B„Ci...c m is 
engineered to be different from the GHZ state. We continue 
to concentrate on the case where only a single qubit of Bob 
is under the control, as illustrated in Fig. [TJ this is because 
it is straightforward to extend the scheme so that multi- 
ple qubits are under the control. Such an extension will be 
considered only in Sec. 14.31 



3 (k, m)-Threshold Controlled 
Quantum Teleportation 

The functionality of threshold control is achieved by engi- 
neering the initial setup of the shared state given by Eq. 



3 This is because a computational basis state |c) of a qubit can 
be written as |c) = -^j X)h=+i — 1( — l) c ==— I' 1 ) using the X-basis 
states \h). 



(HJ). Let us begin with a rather expensive scheme that is 
a straightforward extension of a classical secret sharing. In 
this scheme, the state of the controllers' portion is assumed 
to be in the following form 



\ K (y))d 
i 



E 



e ive(ci - c ^\c 1 ...c m ) Cl . 



(3) 



^es 



where y = j n ®x n , c s G {0, . . . , d— 1} (s S {1, m} and d is 
a positive integer), and S is a certain set of m-digit strings; 
the computational basis for each C s is chosen arbitrarily and 
known by the sth controller. There are two conditions for 
the state appropriate for a (k, m)-threshold scheme: 

(i) 0(ci...c m ) cannot be uniquely determined unless the se- 
quence c\...c m is completely specified (i.e., unless the vari- 
ables ci, c m are all specified). 

(ii) A string c\...c m is uniquely determined in S by fixing 
any k digits of ci, c m . 

Under these conditions, k controllers' measurements result 
in a single surviving vector \c\...c m ). Thus Bob can recover 
the original state by the following process (in addition to 
the usual process for the original quantum teleportation 
for I — l,...,n — 1). First Bob changes the phase factor 
e i3/0(ci...c m ) £ Q UIU ty D y applying 



1 







e -iO(a...c m ) 



to the qubit B„. Second Bob applies Z ln X^ n to B„ as is 
usual for a quantum teleportation. In these steps, Alice's 
Bell measurement on A'„A„ prior to controllers' measure- 
ments does not affect Bob's operation to recover the phase 
appearing as a result of controllers' measurements. This is 
clear from the initial state described in Eq. j2]); the parame- 
ter y = j n (Bx n is common in the states of B„ and controllers' 
portion. 

Let us turn to a system construction for satisfying the 
conditions. Condition (i) is satisfied by setting 6{ci...c m ) — 
~Y^ =1 c s ir/d. Such 6[c\...c rn ) cannot be uniquely determined 
unless the variables ci,...,c m are completely specified. A 
quantum circuit to attach the phase factors is easily realized: 
from s = 1 to m, applying an A„-controllcd C s -controlled 
phase gate with the phase c s ir/d, acting on a work qubit 
accomplishes this task. For the condition (ii), we will find 
a proper set S of m-digit vectors c\...c m by a certain cod- 
ing scheme. This is the main concern as the resource for 
quantum information processing is limited in the current 
technologies; a coding with a small resource is desirable. 

We revisit the theory of Karnin et al. [24] , which describes 
a sufficient condition for coding in a threshold scheme, and 
evaluate a polynomial-coding scheme [531 as a typical 
example. 

We begin with a well-known property of a linear matrix 
equation. 

Proposition: A solvable matrix equation over 
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GF(p), 

Ax = b 

with p a prime number, A 6 GF(p)-^ xs , x 6 
GF(p) 9 , and b S GF(p)* has a unique solution 
x if and only if / > g and A has a full rank. 

The proof is similar to the case of a real number field (see, 
e.g., Ref. [3S pages 96,103]). 

Proof — (i) First we prove that the solution x is unique if 
/ > g and A has a full rank. Assume that there are two 
solutions Xi and X2. Then, Axx = Ax2- Let us pick up 
g rows of A appropriately to generate A so that A has a 
full rank. This is possible because otherwise the number of 
linearly independent row vectors of A should be less than g, 
which is a contradiction. We have thus Ax\ = Ax2 with the 
square full-rank matrix A. The matrix A can be reduced to 
a diagonal matrix with nonzero diagonal elements by basic 
operations; thus detA ^ 0. Consequently, Xi = X2 because 
A^ 1 exists. This is a contradiction, (ii) Second we prove 
that / > g and A has a full rank if x is a unique solution. 
The contraposition of this statement is that solution x is 
not unique if / < g or rank A is less than min(/, g). This is 
easily shown to be true. □ 

On the basis of this proposition, a coding of our interest 
is achieved by a matrix equation for (/, g) = (to, k) with a 
full-rank matrix A such that striking any (m — k) rows keeps 
the rank full [24] . Given a matrix equation 



Ax = (ci, . . . ,c m )* 



with such A which is notified to Bob, we prepare 
l«(j/)>Ci...C m as 



|«(s/))ci...c m 



e i y e ^-^\c 1 ...c m ) Cx ...c„ 



where S x is a set of c\ . . . c m corresponding to x G GF(p) k 
(hence #5 X < p k ). Suppose that at least k controllers mea- 
sure their qudits in the computational basis. Then x is fixed 
uniquely because the matrix equation becomes solvable by 
using the rows corresponding to the fixed c s 's. This implies 
that the superposition is then resolved. Bob can determine 
the phase factor that he should modify by receiving at least 
k outcomes from controllers. 

We have seen a common construction of a threshold 
scheme. Required resources for the threshold scheme are 
mostly dependent on the choice of the matrix A. There are 
two practical ways among many [241 125] . One is the matrix 
in the form 



.4 



(i) 



(I\T 



with / the k x k identity matrix and T a k x (to — k) strictly 
totally positive matrix |37[ 138] . Any minor of T is nonzero 
positive from the definition of strict total positivity; hence 



any k rows of A build up a square matrix with nonzero de- 
terminant. Thus a matrix equation with A^ can be used 
for the threshold scheme. A drawback is the difficulty to 
find a strictly totally positive matrix T for sufficiently small 
prime p. A known systematic construction [39] for strictly 
totally positive matrices uses the largest element of T grow- 
ing exponentially in dim T . Thus p also grows exponentially 
if we follow the construction. A manual optimization is in- 
dispensable. 

The other is a Vandermonde matrix used in the well- 
known Shamir's scheme 123 , 



^(ii) — Vm,k — 



A 

1 

Vi 



Xi 



,.2 

x l 



mod p (5) 



V 



with mutually different x^s with prime p > to— 1. (p > to— 1 
is necessary to set x^s mutually different.) Striking (to — k) 
rows generates a square Vandermonde matrix and it is non- 
singular when XiS are mutually different (see, e.g., pages 
43 and 219 of Ref. [40]). Hence a matrix equation with 
can be used for the threshold scheme. This matrix has 
been known to be economical because p increases linearly 
in to. Each qudit distributed to a controller should have 
the dimension d > p, consequently. Nevertheless, one may 
need to further reduce the dimension considering the poor 
resources of presently available qudit systems [35l [41] . 



(4) 4 



Economizing the Threshold Con- 
trol Scheme 



The dimension of each digit distributed to a party (a con- 
troller in the present context) is often evaluated by using the 
scale of "bit length" in conventional secret sharing schemes. 
Each key is 0(logm)-bit long [23] (O(m)-bit long [301131]) 
in the best known protocols for a short secret with the bit 
length O(logTO) (for a long secret with the bit length 0(m)) 
although this has not been taken as a drawback at all since 
classical bits are very cheap. Nevertheless, in quantum pro- 
tocols one should not consume many qubits for individual 
quantum systems. It is of our concern to find a smaller di- 
mension for each controller's qudit facing a limited resource 
of a quantum system. 

One way is to abandon the use of quantum systems for 
controllers' portion and instead use a classical threshold 
scheme to control a quantum teleportation. A controlled 
teleportation proposed by Zhang and Man [33], in the con- 
text of (to, to) threshold, uses classical keys shared by Alice 
and controllers for encoding Alice's messages, which can be 
easily extended to a general threshold-control scheme. Here, 
we introduce a different scheme where controllers' qudits are 
simply replaced by classical digits. We will face the fact that 
classical control schemes are indeed economical but their se- 
curity is based on classical keys. Using qudits is found to be 
more robust against Bob's physical-access attack. 
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Our interest is to find such a robust scheme with a sim- 
ple quantum state for the controllers' portion. It is shown 
to be constructed by using the matrix equation with the 
Vandermonde matrix ([5]) and qubit states distributed to the 
controllers. We further perform an economization in the 
number of Bob's operations, which is useful for an exten- 
sion in which multiple EPR channels are under controllers' 
control. 

4.1 Classically-Controlled Quantum Tele- 
portation 

As we mentioned, the simplest way of economization is to 
use classical control digits instead of quantum ones. This is 
easily achieved by setting the state (not a state, actually) of 
the controllers' portion to be a scalar 

|«(»))c 1 ...c„ = eW*'"* ^ 

with phase 9 dependent on integers ci,...,c m , the classical 
keys of a certain classical threshold scheme. Bob can modify 
this scalar factor by applying diag[l, e - 4e ( c i.- -. c m)j ^ j^g 
qubit B„ if he can gather at least k of the keys. 

The security of the scheme is dependent on the classical 
scheme. Indeed, classical keys can be securely distributed 
by using a quantum key distribution (see Ref. [42] and ref- 
erences therein) and the risk of an interception during the 
key distribution is negligible. Classical keys are, however, 
easily copied by careless controllers. A possible drawback 
of the scheme is that controllers cannot stop Bob from re- 
covering Alice's original state if Bob manages to obtain at 
least k of the keys without consent of the controllers. In 
contrast, in a threshold scheme using qudits, the operations 
for a recovery of the original state are unfixed until k con- 
trollers make measurements. This fact makes the quantum 
one more robust: Recall that the computational basis for C s 
in Eq. j3]) is not necessarily known in public. The correct 
basis for a measurement can be left unknown to Bob. Then, 
Bob cannot obtain c s by a physical access to C s unless he 
also has an access to the information on the measurement 
basis. Thus the cost for Bob to steal c s 's in the scheme is 
more than that in the classically controlled one. This logic is 
similar to the one utilized for keeping the security of dealer- 
player communications in some quantum threshold schemes 
[321 [34]. 

It should be mentioned that robustness depends on the 
type of protocol violations. Let us discuss a different type of 
violation that can be made by Bob. It is a common occasion 
that controllers do not want Bob to process further with a 
teleported state before they officially vote for their decision. 
A violation in this regard occurs when k or more controllers 
are friendly to Bob and they measure their qudits or digits 
and send the outcomes before the voting starts officially. 
This violation in the schedule of the procedure cannot be 
prevented even if qudits are distributed. 

In the following, an economical quantum control scheme 
is introduced in order to reduce the resource for controllers' 



quantum system as we have mentioned. It is now our addi- 
tional motivation to resolve the schedule violation problem 
due to friendly controllers. 

4.2 Economical Quantum Threshold- 
Controlled Quantum Teleportation 

As is discussed above, a quantum threshold scheme has a 
classically unachievable property, namely that the opera- 
tions for a recovery of the original state are unfixed until 
controllers make measurements and the measurement bases 
can be left unnotified to Bob. As we have mentioned, our 
aim is to achieve such a scheme using small-dimensional sys- 
tems for controllers' portions. Here, we propose a quantum 
protocol for the (k, m)-threshold controlled quantum tele- 
portation with m qubits distributed to the controllers. It 
also resolves the problem of the possible violation in the 
voting schedule. 

It is implemented with the following state for the con- 
trollers' portion: 

Hy)) Cl ...C m 

= -L (g)[e i27r ^/ p |6 s ) + e l2 ^/P\l s )] Cs , 
v2 m s=1 

where |0 S ) and |l s ) are the basis vectors of the sth con- 
troller's chosen basis; ~^y is a logical negation of y and c s 's 
are the keys of the following common classical polynomial- 
coding threshold scheme. The keys are generated from 
Eq. ^ using a Vandermonde matrix for A and a certain 
fixed vector for x [all the matrix and vector elements are in 
GF(p)]. The matrix A is notified to Bob and x is hidden. 
Thus k or more keys are required for Bob to determine the 
remaining keys from Eq. ([¥]). 

The protocol imposed to controllers is as follows. 

(I) Each controller C S!agr ec who agrees to allow Bob to re- 
cover Alice's original state measures her/his qubit in the 
basis {|0 S ), |l s )} and sends its outcome r s € {0, 1} to Bob. 

(II) C S] ag re e also sends her/his key c s to Bob. 

(III) Each controller C 5)t jisagrcc who disagrees to allow Bob 
to recover Alice's original state does not make any action 
until she/he receives a contact from Bob. 

(IV) When a solicit is sent from Bob, C s . disagree must mea- 
sure her/his qubit in the basis {|0 S ), |l s )} and send its out- 
come r s G {0, 1} to Bob. 

The protocol imposed to Bob is as follows. 

(i) Bob receives (z n j,)'s from Alice. Bob applies 

toBi...B n _i. 

(ii) Bob waits for at least k pairs of (r s ,c s )'s sent from the 
controllers. 

(iii) Bob calculates the remaining c s 's by substituting the 
obtained c s 's into Eq. @ if at least k pairs are obtained; 
aborts otherwise. 

(iv) Bob sends solicits to the controllers who did not send 
information to him. 

Note: it is possible to count his solicits. Therefore, he can- 
not cheat by sending more than (rn — k) solicits in this stage 
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even when he succeeds in stealing k or more c s 's beforehand. 

(v) Bob receives the remaining r s 's. 

(vi) Bob modifies the phase factor due to controllers' mea- 
surements in his phase recovery process described below. 

(vii) Bob applies Z ln X^ n to B n . 

Bob's phase recovery process corresponding to the 
controllers' measurements — The m controllers' mea- 
surements (of course, after Alice's Bell measurements) make 
the component state for A'„A„B„Ci...C m in Eq. @, with 
the controllers' state ([6]) in the present context, evolve into 
the state 

1 

£ (-1)*"-" \B indn ) A , nAn |y) Bn \n(y)) Cl ... Cm 

y=jn®x„—o 

with 

|«(2/))c 1 ...c m 

The phase factor 

Y[exp[i2w{->) rs yc s /p] 

s 

should be canceled by Bob before the normal recovery op- 
eration is performed in step (vii). The cancellation of the 
factor with probability one is possible if and only if all the 
controllers follow the protocol and at least k of them send 
c s 's to Bob (otherwise he will get an uncertain state as his 
operations become a guesswork). Since c s 's are classical keys 
of a (k, m) threshold scheme, k or more of them are neces- 
sary and sufficient to find out all of them. Bob can eliminate 
the phase by applying 

Y[ diag[exp(-i27rr s c s /|»), exp(-i27r-ir s c s /p)] (7) 

s 

to his nth qubit B„. This operation is unaffected by Alice's 
Bell measurement on A' n A„ as is clear from the initial state 
described in Eq. ([2]). 

In this way, the (fc, m)-threshold control is realized by us- 
ing only qubit systems for individual portions. One may 
notice that it is a hybrid scheme in the sense that the (fc, m) 
threshold is realized by a classical threshold scheme. Al- 
though classical keys are used, we claim that this scheme 
possesses a property thanks to a quantum control; the re- 
covery operations are unfixed unless all the controllers make 
measurements, and the measurement bases are unknown to 
Bob. The measurements are not completely performed un- 
less there are at least k C Sjagre e's and Bob sends at most 
(to — k) solicits to C^disagrcc's. Hence, in order to cheat 
under the protocol, Bob needs to collect c s 's, qubits, and 
measurement bases of at least k controllers. 

The scheme has an advantage over the previously- 
introduced quantum scheme in the sense that it is secure 



against the possible schedule violation due to friendly con- 
trollers. Owing to step (IV), Bob has to wait for an official 
voting time to obtain Alice's original state unless the con- 
trollers violate the voting schedule all together. 

4.3 Economization in Bob's Operations 

We have shown an economized quantum (or hybrid) con- 
trolled quantum teleportation using the state ^ for the con- 
trollers' portion, in which the dimension of each distributed 
qudit has been reduced to two. As two is the minimal di- 
mension for a nontrivial quantum system, it is optimized 
with respect to the dimension of a Hilbert space of each 
portion. Here we consider an economization of Bob's opera- 
tions to eliminate the phase factor coming from controllers' 
measurements. 

The number of Bob's single-qubit operations for the re- 
covery is not important as far as a single EPR channel is 
under the controllers' control because Eq. ([7|) reduces to a 
single operation. It is, however, not negligible in case we ex- 
tend the setup to the one illustrated in Fig. [21 in which we 
may have multiple shared states. Each controller is assigned 
to a single A;B; pair and the total number of controllers is 

TO. 
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Figure 2: A straightforward extension of the system setup 
shown in Fig. [TJ such that controllers are assigned to mul- 
tiple channels. Each A;B; pair is not necessarily under the 
supervision of controllers. 

Let us use the same state as in Eq. except the labels 
of controllers, for each of the controllers' portions (repre- 
sented by dotted lines inside the square of "Controllers" 
in Fig. [21). We change the protocol for controllers in the 
following way. 

(A) A controller who Agrees to allow Bob to recover the 
original state makes a measurement on her/his qubit in the 
basis {|+ s ),|- s )} with \± s ) = |0 S ) ± |l s ). She/he sends 
Bob the outcome u s € {+, — } together with c s . 
(D) A controller who Disagrees does not make any action. 
However when a solicit is sent from Bob, a controller who 
Disagrees must make a measurement on her/his qubit in 
the basis {|0 S ), |l s )} and send Bob the outcome v s £ {0, 1}. 

To understand the effect of a measurement, let us decom- 
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pose each component of the state © in the following way: 
1 



i27r»c s /p|Q^ +e i27r^c s /p||^] 



1 



2V2 



First consider the case (A). 
(A-i) Suppose that the outcome of a measurement by the 
sth controller is +. Then, the unnormalized phase factor 
owing to this measurement is 

e i2iryc a /p _|_ ^2-K^ycJp — ^ + e i27rc "/P 

which is a global phase uncorrelated with y. Thus Bob does 
not have to modify it. 

(A-ii) Suppose that the outcome of a measurement by the 
sth controller is — . Then, the unnormalized phase factor 
owing to this measurement is e 427ryCs / p — e l2 *~' yc °/ p , which 
can be regarded as 



t (y = 0) 

-a (y=l) 



with a = 1 — e l27rCa/,p . Thus Bob can modify the factor by 
applying Z to some B; for which the controller's qubit is 
originally connected in Fig. [2] 

Second consider the case (D). 
The phase factor due to the measurement, with the outcome 
v s € {0, 1}, is exp[i2Tr(-^) Vs yc s /p\. This can be modified by 
applying 

diag[exp(-i27rv s Cs/p),exp(-i27r^v s c s /p)] 

to a proper B;, which is possible if Bob knows c s , namely, if 
k or more controllers follow (A). 

In addition to the above recovery of the phase factors 
corresponding to controllers' measurements, Bob applies 
Z H X^ 1 to each Bi, as usual, to recover the phase factors 
corresponding to Alice's Bell measurements. 

Let us estimate the reduction in the number of operations 
that Bob has to apply to Bz's for eliminating the phase fac- 
tors due to controllers' measurements. Let us consider the 
worst case where the m controllers are assigned to mutually 
different channels. In our previous protocol, the number 
of the operations is m. In the present protocol, it is, on 
average, t/2 + (m — t) = m — t/2 with t the number of con- 
trollers who agree to allow Bob to recover the original state. 
(Of course, Bob cannot recover the state when t < k.) 

5 Operational Complexity 

In the previous section, a quantum (or hybrid) (A;,m)- 
threshold controlled quantum teleportation using qubits 
(without qudits whose dimension is more than two) has been 



constructed. We will count the number of single-qubit op- 
erations and that of two-qubit operations by following the 
whole process. Here, we consider the case where the con- 
trollers are attached to the nth EPR channel A„B„ and 
regard Bob's recovery operation corresponding to each con- 
troller's measurement as a single operation, for simplicity. 
The number of operations is unchanged by employing the 
setup illustrated in Fig. [2] 

The process is the same as the original quantum telepor- 
tation pQ except for the measurements and operations acting 
on the shared state of A„B„Ci...C m , as we have seen in Sec. 

m 

For the part without controllers in Fig.[TJ there are (n — 1) 
EPR pairs prepared between Alice and Bob. The quan- 
tum circuit for preparing the EPR states involves (n — 1) 
Hadamard gates and the same number of controlled-NOT 
(CNOT) gates. Alice makes (n — 1) Bell measurements 
between the system A'i...A'„_i and the system Ai...A n _i 
and sends the outcomes (i, , j t ) as classical information to 
Bob. Bob applies 2(n — 1) single-qubit operations at most, 
namely, Z H X 31 , according to the classical information 

received from Alice. 

For the portion of the shared state in the figure, the initial 
state 



1 

V2 



^2\yy}A n B„\K(y)} Cl ...c„ 

y=0 



with |K(y))c 1 ...C m given by Eq. ([6]) should be prepared. It 
is prepared as follows. First we produce the state 



1 

71 



j/=0 



|0 s )c s 



This is easily prepared by a single Hadamard gate and a 
CNOT gate acting on A„B„. The state |0 s )c s is a ba- 
sis vector in the sth controller's favorite basis. Second, m 
Hadamard gates are applied to Ci...C m individually in their 
bases. In addition, the operation 

diag [1 , exp (i2irc s / p) , exp (i2nc s /p) , 1] 

is applied to A„C S for all s 6 {1,...,to} in the basis 
{|0),|1)} A „ ® {|0 s ),|l s )}c„- The desired initial state for 
A„B„Ci...C m is now achieved. In the teleportation stage, 
Alice makes a Bell measurement on A'„A„ and sends Bob 
the outcome (i n ,jn)- The controllers and Bob follow the 
protocol as described in Sec. 14.21 or that in Sec. 14.31 In 
this process, Bob can eliminate the phase factors due to 
controllers' measurements if k or more controllers agree to 
allow Bob to obtain the original state. Finally, Bob applies 
Z I ™A- J '* to B„. After all these steps, he obtains the original 
state of A'l.-.A'n in Bi...B„. 

With the above description of the process, we find that the 
number of single-qubit operations and that of two-qubit op- 
erations for preparing the initial state of the whole system 
are n + m for both operations. The teleportation process 
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involves n Bell measurements performed by Alice and m 
single-qubit measurements performed by controllers. It also 
involves Bob's recovery operations: (i) at most 2n single- 
qubit operations corresponding to Alice's measurement out- 
comes; (ii) TTi single qubit operations [on average, (m — t/2) 
single-qubit operations] corresponding to controllers' mea- 
surement outcomes when the protocol described in Sec. 14.21 
is employed [when that in Sec. 14.31 is employed]. 

In addition, as we have mentioned in Sec. 14.31 the oper- 
ations of (ii) reduce to a single operation in reality for the 
present setup while it does not for the setup of Fig. [2] 

6 Discussions 

We have proposed an economical scheme for a (k,m)- 
thrcshold control of a quantum teleportation. It uses a 
shared state of Alice, Bob, and controllers with the con- 
trollers' portion in the state of Eq. ([6]), which consists of 
qubits only. Thus a drawback of a usual polynomial cod- 
ing, namely, the required dimension d > p > m — 1 for 
each controller's qudit, has been resolved. In addition, it is 
straightforward to extend the scheme so that multiple qubits 
in Bob's portion are under the threshold control. 

Our economical scheme can be seen as a hybrid of a stan- 
dard (m, m)-threshold controlled quantum teleportation and 
a (k, m)-threshold classically-controlled quantum teleporta- 
tion, as we have mentioned in Sec. 14.21 It should be noted 
that this has been realized by a nontrivial protocol using 
the state ([6]). The scheme has a good redundancy for the 
securement of the (k, m) threshold: (i) To modify the phase 
factors owing to controllers' measurements, k or more clas- 
sical keys are required for Bob. (ii) To make disagreeing 
controllers perform measurements, at most (m — k) solicits 
should be sent from Bob. In fact, the standard controlled 
teleportation in the context of (m, m) threshold can be used 
in the context of (k,m) threshold by stating only (ii) in its 
protocol. The advantage of our economical scheme over this 
simple extension is, thus, the redundant securement. 

The scheme is, however, not as economical as a classically- 
controlled quantum teleportation, as we have discussed in 
Sec. 14.11 A quantum threshold-control scheme is certainly 
more expensive than a classical threshold-control scheme. It 
is thus recommended to assess the trade-off between the ben- 
efit and the cconomicalness to choose an appropriate scheme. 

The benefit to distribute qudits (qubits in our scheme) 
among controllers is to make the recovery operation of Bob 
unfixed unless controllers make measurements. This makes 
the protocol robust against Bob's attack to the keys: In 
order for cheating, he needs both physical accesses to at least 
k controllers' qudits and information on their measurement 
bases. One may however claim that careless controllers tend 
to lose both of them at once in a real world. Our economical 
scheme possesses a clearer advantage also: it can prevent a 
violation of a voting schedule, i.e. it can prevent Bob from 
recovering the original state before an official voting time, 
unless controllers violate the schedule all together. 



There is one drawback in our protocol. In case we use the 
scheme of Sec. |3l controllers who disagree to the telepor- 
tation do not have to measure their systems. In contrast, 
in our economical protocol, a disagreeing controller has to 
measure her/his qubit if a solicit is sent from Bob. Our pro- 
tocol can be broken by a controller who does not follow this 
regulation. It seems an important drawback at a glance, 
but there is a quick solution: one can easily find out which 
controller cheats in the protocol. Any controller who does 
not send a measurement outcome despite a solicit sent from 
noncheating Bob is a cheater. 

A clever cheater, however, may report an opposite mea- 
surement outcome and/or a wrong key instead of being 
quiet. It has been well-known that a basic secret sharing is 
not robust against dishonest participants who report wrong 
keys. There have been several proposals to remedy this 
drawback in classical secret sharing schemes [43 , 4H 25J |3S] • 
These classical schemes are easily combined into our scheme 
in order to find cheating in the keys c s , as is clear from the 
protocol. Nevertheless, a protocol to find cheaters sending 
wrong messages as measurement outcomes should be newly 
constructed. One way to achieve this task is to add a su- 
percontroller who grasps controllers' states by entangling 
her/his systems and their corresponding systems. Let the 
supercontroller know their measurement bases. Then the 
supercontroller can check the measurement outcomes after- 
ward. It is hoped that a more sophisticated way will be 
developed. 

Finally, we discuss a well-known strategy to use controlled 
quantum teleportation as a secret sharing to hide a quan- 
tum state as a secret [7]. Any (k, m)-threshold controlled 
quantum teleportation in the stage after Alice's Bell mea- 
surements is regarded as a (k, m)-threshold quantum secret 
sharing: Alice's original state to be recovered in Bob's side 
is regarded as a secret and the controllers are regarded as 
participants sharing the secret. A drawback of this approach 
is that the original state is recovered in the system of Bob's 
side; participants who try to cooperate for recovery should 
gather at this side or ask a dealer for proxy. 

A solution to avoid this drawback is to construct m 
initially identical copies of the entire system K for the 
(k, m)-threshold controlled quantum teleportation, where 
K = A'iAi...A / ra A ra Bi...B n Ci...C TO . Let us write a copy as 
K u = A7A^.A'^A£B5 1 ...B£C5 1 ...C£ l with u e {l,...,m}. 
We send the system B^...B^, together with classical in- 
formation obtained by the Bell measurements on each of 
A'" A", A'^A^, to the vth participant [v £ {l,...,m}). 
The wth participant should also receive C\, ...,C™, namely 
the vth. control systems of all K"'s. The wth participant 
can recover the original state in the system B^...B^ when 
she/he gets to know the measurement results on k or more 
among C\, C^, including her/his own, and corresponding 
classical keys if they are used in the scheme. 

This approach possesses the following benefit. The orig- 
inal quantum secret sharing is limited to m < 2k — 1 due 
to the no-cloning theorem when an unknown quantum state 
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is a secret |26j . A controlled quantum teleportation with 
a (k, m)-threshold control is not limited by the no-cloning 
theorem because the secret, namely, Alice's original state, is 
teleported to Bob's system. The approach is practical when 
we use classical keys for controlling a quantum teleporta- 
tion. The resource required for this case is m classical keys 
and m copies of the system that consists of n EPR pairs 
and the n-qubit original state. Of course, the m copies of 
the system are reduced to one copy in case participants may 
gather in a particular place or may use a trusted dealer for 
proxy. 

There seems to be no serious drawback of using classical 
control because the classical keys can be securely distributed 
and a scheduled vote is not interposed usually for a secret 
sharing. The robustness of our economical scheme is effec- 
tive when an untrusted Bob exists. This is due to the fact 
that the measurement basis of each controller can be hid- 
den. In this sense, our economical scheme might be used 
for a secret sharing to build in robustness against physical 
access attacks by malicious participants who try to cheat. 
Nevertheless, it is not attractive to spend many EPR pairs 
despite the reduction in the resource for controllers' portion. 
A choice of a proper scheme is dependent on the demand of 
participants when a controlled quantum teleportation is ap- 
plied to a secret sharing. 

We have discussed the advantage and disadvantage of our 
scheme in which the dimension of each controller's qudit 
is reduced to two. This reduction is indeed significant for 
physical realization of the threshold control of a quantum 
teleportation. Nevertheless, it is controversial as to which 
extent a controlled quantum teleportation should be per- 
formed with quantum resources. The answer depends on 
the application and as to which party is trusted, as is clear 
from the above discussions. 



7 Summary 

We have proposed an economical protocol for (fc,m)- 
threshold controlled quantum teleportation. This proto- 
col uses qubits distributed to controllers; hence we have 
achieved the reduction in the dimension of each qudit from 
a prime p > m — 1 to two. In addition, we have shown an 
economization in the number of Bob's recovery operations. 
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